Privacy Policy

1. Who is responsible for your data

1.1 Quri Technologies FZ-LLC, In5 Tech, Dubai Internet City, Dubai, is the controller of the data described in this Section A. You can reach us at admin@quri.co.

1.2 At some locations, a mall operator or landlord is the controller of order data under its agreement with us, and we act as its processor. Section B explains where that applies.

2. What we collect

When you place an order:

• Your mobile number, and your email address if you give one
• Your order details, including items, quantities, notes, value, date and time, outlet, and table or collection point
• Payment confirmation details, including the payment method, the last four digits of your card and the transaction reference. We do not receive or store your full card number
• Technical details, including your device, browser, IP address and the approximate location it indicates

If you create an account, we also collect:

• Your name and any contact details you give us
• Saved preferences, dietary settings and favourites
• Your order history across every merchant where we operate
• Loyalty balances, rewards and entitlements
• Your marketing preferences

If you contact us, we keep your message and our correspondence with you.

3. How we use it

We use personal data on the following bases under the PDPL:

• To take, process and fulfil your order, take payment, tell you when it is ready, and handle refunds and complaints. This is necessary to provide the service you have asked for
• To run and secure the platform, prevent fraud and misuse, and keep proper records. This is in our legitimate interests
• To meet our legal obligations, including tax and accounting requirements
• To run your account, personalise your experience, and provide loyalty and rewards. This is to perform our agreement with you, and with your consent where needed
• To send you marketing about Quri and participating merchants. This is with your consent, which you can withdraw at any time
• To understand how the service is used and improve it, using aggregated or anonymised data wherever we can. This is in our legitimate interests

4. Who we share it with

• The merchant you ordered from, which gets your order details so it can prepare it, and the contact details needed to sort out any problem with that order
• Our payment provider, which processes your payment and handles any dispute or chargeback
• The mall operator or landlord, where it is the controller of that data as described in Section B
• Our suppliers, including hosting, messaging, analytics and customer support, which act on our instructions
• Our advisers, auditors and insurers where necessary
• Authorities, regulators or courts where the law requires it
• A buyer or successor if we sell or transfer our business, with the same protections in place

We do not sell your personal data, and we do not share it with anyone for their own marketing without your consent.

5. Where your data is held

5.1 Your data is hosted on servers in the United Arab Emirates. Some of our suppliers process data outside the United Arab Emirates.

5.2 Where we transfer data outside the UAE, we do so only to a country recognised as offering adequate protection, or under contractual safeguards that meet PDPL requirements, or with your consent where that is permitted.

6. How long we keep it

6.1 Order and transaction records are kept for as long as UAE tax and accounting law requires, currently five years from the end of the relevant tax period, and longer if a dispute is still open.

6.2 Account data is kept while your account is open and for a reasonable period afterwards, so we can deal with anything outstanding.

6.3 Technical and analytics data is kept no longer than we need it, and is aggregated or anonymised where possible.

7. Keeping it secure

7.1 We use security measures appropriate to the risk, including encryption in transit and at rest, access controls and monitoring.

7.2 Card data is handled by our payment provider under card scheme security standards. We do not hold full card numbers.

7.3 If a data breach happens that is likely to affect your privacy, security or rights, we will notify the UAE Data Office and, where required, you.

8. Your rights

Under the PDPL you can:

• Ask what data we hold about you and get a copy
• Have anything inaccurate or incomplete corrected
• Ask us to delete your data, where there is no legal reason to keep it
• Ask us to restrict or stop processing in certain situations
• Object to processing we carry out on the basis of our legitimate interests
• Receive your data in a machine-readable format, or have it sent to another provider
• Withdraw your consent at any time, where we rely on it
• Object to automated decisions that have a legal effect on you

Email admin@quri.co to use any of these and we will respond within the time the law allows. Where a request concerns data that another party controls, as explained in Section B, we will pass it to them and let you know. If you are unhappy with how we have handled your data, you can complain to the UAE Data Office.

9. Cookies

9.1 We use cookies that are strictly necessary to run the platform, keep you signed in and secure your session. These do not need your consent.

9.2 Where we use analytics or preference cookies, we ask first, and you can change your mind at any time.

10. Children

10.1 Quri is not for children under 18 and we do not knowingly collect their data. If you think a child has given us data, email admin@quri.co and we will delete it.

11. Changes to this policy

11.1 We may update this policy. The current version is always on our website with the date it was last updated. If a change materially affects you and you have an account, we will tell you before it takes effect.

12. Orders placed without a Quri account

12.1 We operate at Dubai Festival City Mall under an agreement with Dubai Festival City Retail Development LLC, referred to here as the Mall Operator.

12.2 If you order at Dubai Festival City Mall without signing in to a Quri account, the data from that order is owned by the Mall Operator under that agreement. The Mall Operator is the controller of it under the PDPL, and we act as its processor.

12.3 That data covers the items you ordered, the order value, the date and time, the outlet, the table or collection point, and the mobile number you give so we can tell you your order is ready.

12.4 As processor, we handle it only on the Mall Operator's documented instructions and in line with the PDPL, to take and fulfil your order, take payment, notify you, sort out problems and refunds, keep the service secure, personalise your experience within the mall, and report on how the service is performing.

12.5 We do not use that data for our own purposes, we do not use it outside Dubai Festival City Mall, and we do not sell it.

12.6 To exercise your rights over that data, email admin@quri.co. We will pass your request to the Mall Operator, confirm to you that we have done so, and help you follow it up.

13. Orders placed while signed in

13.1 If you have a Quri account and are signed in when you order, your account and your Quri profile are owned by us, and we are the controller of them.

13.2 That covers your name and contact details, your account records, your saved preferences and favourites, your loyalty balances, your marketing preferences, and your order history across every merchant where we operate, including Dubai Festival City Mall.

13.3 We use it as described in Section A, including to run your account, personalise your experience across Quri, and provide loyalty and rewards.

13.4 The Mall Operator still receives the order data for orders you place at its venues and remains the controller of that order data. Your wider Quri account and your activity at other venues are not shared with the Mall Operator.

14. If you create an account later

14.1 If you order without an account and later create one with the same mobile number, we may link that earlier order to your account so your history and any loyalty entitlement are complete. The Mall Operator remains the controller of the order data from those earlier orders.

15. Merchant and staff data

15.1 Quri is the controller of the merchant contact and staff data given to us. That includes:

• The names, roles, email addresses and mobile numbers of your owners, managers and staff
• Login and access records for the merchant dashboard and any device we provide
• Bank, licence, tax registration and other onboarding details, including any that identify an individual
• Correspondence with us, including support requests and training records

15.2 We use it to set up and run your account, provide support and training, send you order and service notifications, keep the platform secure and prevent fraud, produce reports and invoices, and meet our legal, tax and accounting obligations.

15.3 We share it with our suppliers, including hosting, messaging and support, with our payment provider where needed to settle payments, with our advisers and auditors, and with authorities where the law requires it.

15.4 We keep it while your agreement with us is live and for as long as UAE tax and accounting law requires afterwards.

15.5 Your staff have the rights set out in clause 8. Email admin@quri.co to use them.

16. What the merchant receives about customers

16.1 The merchant receives order data only. That means the items ordered, the order value, the date and time, the collection point or table, and the contact details needed to fulfil the order and resolve a problem with it.

16.2 The merchant may use that data to fulfil the order, meet its tax, accounting and food safety obligations, and handle complaints and refunds.

16.3 The merchant may not use that data for its own marketing without the customer's consent, and may not sell it or pass it on for anyone else's marketing.

16.4 The merchant does not receive the Quri customer account, a customer's order history at other merchants or venues, or loyalty membership, balances or entitlements, and has no claim to any of it during the agreement or after it ends.

16.5 Where the Mall Operator is the controller of order data, as described in Section B, the merchant's use of that data is also subject to that arrangement.

17. The merchant's own obligations

17.1 The merchant is responsible for its own compliance with the PDPL for the personal data it receives and holds.

17.2 The merchant must keep that data secure with measures appropriate to the risk, limit access to staff who need it, and control access to any device or dashboard we provide.

17.3 The merchant must keep that data only as long as it needs it for the purposes in clause 16.2, or as long as the law requires, and delete it after that.

17.4 The merchant must not transfer that data outside the United Arab Emirates unless the PDPL allows it.

17.5 If the merchant becomes aware of a personal data breach affecting that data, it must tell us at admin@quri.co without undue delay, give us the detail we need, and co-operate with us and with any regulator.

17.6 The merchant must pass any customer request about that data to us at admin@quri.co without undue delay.

18. Contact

18.1 For anything to do with this policy, email admin@quri.co or write to Quri Technologies FZ-LLC, In5 Tech, Dubai Internet City, Dubai, United Arab Emirates.